3 ms·

I don't think this operation is very unreasonable if highly targeted. If they did this to computers bought by Iran's nuclear program, or known watched mid leve

by rdl 13y ago

I don't think this operation is very unreasonable if highly targeted. If they did this to computers bought by Iran's nuclear program, or known watched mid level jihadis , the only problem I'd have would be I don't have enough money to buy an open bar for everyone involved. No one is arguing this was pervasive. The dangerous area IMO would be domestic law enforcement or political use (well , not so gray), and attacking innocent third parties with this to gain access to systems to attack actual bad guys. ( eg Belgacom)

obstacle1 13y ago
The problem is the NSA has shown itself to be indiscriminate in its targeting for other methods of info gathering. So trusting them to 'use responsibly' is a bit like trusting a bunch of teenagers to 'use responsibly' with a case of beer and the parents away.
- rdl 13y ago
  This operation as described leaves enough of a physical record that it couldn't be used universally. I'm much more concerned about "NSA backdoor firmware", and vastly more concerned about China doing the same. It's a lot easier to do this at design/manufacture than en-route.
  - obstacle1 13y ago
    >I'm much more concerned about "NSA backdoor firmware", and vastly more concerned about China doing the same. No reason the 'upgrades' couldn't be firm/hardware. Just upthread a bunch of people complain about "customs" delays when ordering computers, one person for > 30 days. That is way, way more than enough time. Yes, easier at manufacture. No, not necessary at manufacture. Yes, possible en-route. Also why would you be more concerned about China doing the same? edit: and also the problem wouldn't be using the technique 'universally', as in doing it to every machine. The problem would be giving an org like the NSA full control over deciding who to target, incl. US citizens. That is, being indiscriminate in terms of completely disregarding domestic laws, protections, etc., rather than being indiscriminate in terms of spamming loaded chips in every box.
    - rdl 13y ago
      You might like to know that I'm giving a talk at 30c3 in about 4.5h which will specifically address this threat (using remote-verifiable seals). http://events.ccc.de/congress/2013/Fahrplan/events/5600.html http://events.ccc.de/congress/2013/Fahrplan/events/5600.html
  - sneak 13y ago
    The article doesn't specify if the backdoors installed en route are hardware or firmware/software.
    - rdl 13y ago
      Doesn't matter. It still requires someone being paid <$100k/yr to pull a package off the line and deal with it. If this happened in substantially greater volume than already happens for drug/child porn/money laundering cases, it would be at risk of exposure.

by rdl 13y ago

obstacle1 13y ago

The problem is the NSA has shown itself to be indiscriminate in its targeting for other methods of info gathering. So trusting them to 'use responsibly' is a bit like trusting a bunch of teenagers to 'use responsibly' with a case of beer and the parents away.

rdl 13y ago
This operation as described leaves enough of a physical record that it couldn't be used universally. I'm much more concerned about "NSA backdoor firmware", and vastly more concerned about China doing the same. It's a lot easier to do this at design/manufacture than en-route.
- obstacle1 13y ago
  >I'm much more concerned about "NSA backdoor firmware", and vastly more concerned about China doing the same. No reason the 'upgrades' couldn't be firm/hardware. Just upthread a bunch of people complain about "customs" delays when ordering computers, one person for > 30 days. That is way, way more than enough time. Yes, easier at manufacture. No, not necessary at manufacture. Yes, possible en-route. Also why would you be more concerned about China doing the same? edit: and also the problem wouldn't be using the technique 'universally', as in doing it to every machine. The problem would be giving an org like the NSA full control over deciding who to target, incl. US citizens. That is, being indiscriminate in terms of completely disregarding domestic laws, protections, etc., rather than being indiscriminate in terms of spamming loaded chips in every box.
  - rdl 13y ago
    You might like to know that I'm giving a talk at 30c3 in about 4.5h which will specifically address this threat (using remote-verifiable seals). http://events.ccc.de/congress/2013/Fahrplan/events/5600.html http://events.ccc.de/congress/2013/Fahrplan/events/5600.html
- sneak 13y ago
  The article doesn't specify if the backdoors installed en route are hardware or firmware/software.
  - rdl 13y ago
    Doesn't matter. It still requires someone being paid <$100k/yr to pull a package off the line and deal with it. If this happened in substantially greater volume than already happens for drug/child porn/money laundering cases, it would be at risk of exposure.